General

  • Target

    cb3ca4960d67513d53b11dadf817bf46cc2d19f2c7db598b72a6cdd0ad9be1f6

  • Size

    31KB

  • Sample

    221205-yct98sch5t

  • MD5

    3517a0a5fd3bc95260a7c1a758acb8d0

  • SHA1

    9b50655b506d8a22be461640849cdb76fcd6fa20

  • SHA256

    cb3ca4960d67513d53b11dadf817bf46cc2d19f2c7db598b72a6cdd0ad9be1f6

  • SHA512

    5ecde49b15d5f63aa698f4848abcd6eae5b02651466ce1b0d3b154e5c7439c0f86dd81b0ffd1da4b5aaf5de72fa994b18c2076ceddd34c32fe966775668c13db

  • SSDEEP

    768:q2u75oa4fu124AqFjXeJBKh0p29SgRjB:K75CPkj8KhG29jjB

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

mohsab2.no-ip.biz:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes
  • reg_key

    5cd8f17f4086744065eb0992a09e05a2

  • splitter

    |'|'|

Targets

    • Target

      cb3ca4960d67513d53b11dadf817bf46cc2d19f2c7db598b72a6cdd0ad9be1f6

    • Size

      31KB

    • MD5

      3517a0a5fd3bc95260a7c1a758acb8d0

    • SHA1

      9b50655b506d8a22be461640849cdb76fcd6fa20

    • SHA256

      cb3ca4960d67513d53b11dadf817bf46cc2d19f2c7db598b72a6cdd0ad9be1f6

    • SHA512

      5ecde49b15d5f63aa698f4848abcd6eae5b02651466ce1b0d3b154e5c7439c0f86dd81b0ffd1da4b5aaf5de72fa994b18c2076ceddd34c32fe966775668c13db

    • SSDEEP

      768:q2u75oa4fu124AqFjXeJBKh0p29SgRjB:K75CPkj8KhG29jjB

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks